The Data Protection (Monetary Penalties) (Maximum Penalty and Notices) Regulations 2010

Monetary penalty notices

4.  For the purposes of section 55A(7) the prescribed information is—

(a) the name and address of the data controller;

(b) details of the notice of intent served on the data controller;

(c) whether the Commissioner received written representations following the service of the notice of intent;

(d) the grounds on which the Commissioner imposes the monetary penalty, including—

(i) the nature of the personal data involved in the contravention,

(ii) a description of the circumstances of the contravention,

(iii) the reason the Commissioner is satisfied that the contravention is serious,

(iv) the reason the Commissioner is satisfied that the contravention is of a kind likely to cause substantial damage or substantial distress, and

(v) whether the Commissioner is satisfied that section 55A(2) applies, or that section 55A(3) applies, and the reason the Commissioner is so satisfied;

(e) the reasons for the amount of the monetary penalty including any aggravating or mitigating features the Commissioner has taken into account when setting the amount;

(f) details of how the monetary penalty is to be paid;

(g) details of, including the time limit for, the data controller’s right of appeal against—

(i) the imposition of the monetary penalty, and

(ii) the amount of the monetary penalty; and

(h) details of the Commissioner’s enforcement powers under section 55D(1).

(1)

Section 55D was inserted into the Data Protection Act 1998 by section 144 of the Criminal Justice and Immigration Act 2008 (c. 4).